Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
156s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
06/08/2023, 19:07
Static task
static1
Behavioral task
behavioral1
Sample
fad5bac606710818cfba4fa46914899f8a5279fba34d4959138480bd5b1e8c31.exe
Resource
win10-20230703-en
General
-
Target
fad5bac606710818cfba4fa46914899f8a5279fba34d4959138480bd5b1e8c31.exe
-
Size
560KB
-
MD5
a4c335827487a65a573cd0ea2dd243a1
-
SHA1
2fec0812f1270f63f19e326ff25d21ddbc6af24f
-
SHA256
fad5bac606710818cfba4fa46914899f8a5279fba34d4959138480bd5b1e8c31
-
SHA512
5146e625c40272c5fc00f48180763255ce012200a51c24bd95c5bad6ed763125f3845cd198df368b94fdc25602cabb1fab9d03c1065de435e25fac3afde34c71
-
SSDEEP
12288:BMryy906HFI8fgfbJSMK3n2hyM44HD4A81iPgPWtbEThuI:fyDSEdLnJ7aD4V1PgI
Malware Config
Extracted
amadey
3.87
193.233.255.9/nasa/index.php
Extracted
redline
savin
77.91.124.156:19071
-
auth_value
a1a05b810428195ab7bb63b132ea0c8d
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x000700000001b003-136.dat healer behavioral1/files/0x000700000001b003-137.dat healer behavioral1/memory/4240-138-0x0000000000B10000-0x0000000000B1A000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" p8049353.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" p8049353.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" p8049353.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" p8049353.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" p8049353.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 8 IoCs
pid Process 4516 z4888999.exe 3628 z9046265.exe 4240 p8049353.exe 2516 r3348912.exe 2392 legosa.exe 4852 s2711808.exe 1456 legosa.exe 4128 legosa.exe -
Loads dropped DLL 1 IoCs
pid Process 676 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" p8049353.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" fad5bac606710818cfba4fa46914899f8a5279fba34d4959138480bd5b1e8c31.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z4888999.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z9046265.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 352 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4240 p8049353.exe 4240 p8049353.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4240 p8049353.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 2928 wrote to memory of 4516 2928 fad5bac606710818cfba4fa46914899f8a5279fba34d4959138480bd5b1e8c31.exe 70 PID 2928 wrote to memory of 4516 2928 fad5bac606710818cfba4fa46914899f8a5279fba34d4959138480bd5b1e8c31.exe 70 PID 2928 wrote to memory of 4516 2928 fad5bac606710818cfba4fa46914899f8a5279fba34d4959138480bd5b1e8c31.exe 70 PID 4516 wrote to memory of 3628 4516 z4888999.exe 71 PID 4516 wrote to memory of 3628 4516 z4888999.exe 71 PID 4516 wrote to memory of 3628 4516 z4888999.exe 71 PID 3628 wrote to memory of 4240 3628 z9046265.exe 72 PID 3628 wrote to memory of 4240 3628 z9046265.exe 72 PID 3628 wrote to memory of 2516 3628 z9046265.exe 73 PID 3628 wrote to memory of 2516 3628 z9046265.exe 73 PID 3628 wrote to memory of 2516 3628 z9046265.exe 73 PID 2516 wrote to memory of 2392 2516 r3348912.exe 74 PID 2516 wrote to memory of 2392 2516 r3348912.exe 74 PID 2516 wrote to memory of 2392 2516 r3348912.exe 74 PID 4516 wrote to memory of 4852 4516 z4888999.exe 75 PID 4516 wrote to memory of 4852 4516 z4888999.exe 75 PID 4516 wrote to memory of 4852 4516 z4888999.exe 75 PID 2392 wrote to memory of 352 2392 legosa.exe 76 PID 2392 wrote to memory of 352 2392 legosa.exe 76 PID 2392 wrote to memory of 352 2392 legosa.exe 76 PID 2392 wrote to memory of 1156 2392 legosa.exe 77 PID 2392 wrote to memory of 1156 2392 legosa.exe 77 PID 2392 wrote to memory of 1156 2392 legosa.exe 77 PID 1156 wrote to memory of 3756 1156 cmd.exe 80 PID 1156 wrote to memory of 3756 1156 cmd.exe 80 PID 1156 wrote to memory of 3756 1156 cmd.exe 80 PID 1156 wrote to memory of 4524 1156 cmd.exe 81 PID 1156 wrote to memory of 4524 1156 cmd.exe 81 PID 1156 wrote to memory of 4524 1156 cmd.exe 81 PID 1156 wrote to memory of 4120 1156 cmd.exe 82 PID 1156 wrote to memory of 4120 1156 cmd.exe 82 PID 1156 wrote to memory of 4120 1156 cmd.exe 82 PID 1156 wrote to memory of 4528 1156 cmd.exe 83 PID 1156 wrote to memory of 4528 1156 cmd.exe 83 PID 1156 wrote to memory of 4528 1156 cmd.exe 83 PID 1156 wrote to memory of 5084 1156 cmd.exe 84 PID 1156 wrote to memory of 5084 1156 cmd.exe 84 PID 1156 wrote to memory of 5084 1156 cmd.exe 84 PID 1156 wrote to memory of 5092 1156 cmd.exe 85 PID 1156 wrote to memory of 5092 1156 cmd.exe 85 PID 1156 wrote to memory of 5092 1156 cmd.exe 85 PID 2392 wrote to memory of 676 2392 legosa.exe 87 PID 2392 wrote to memory of 676 2392 legosa.exe 87 PID 2392 wrote to memory of 676 2392 legosa.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\fad5bac606710818cfba4fa46914899f8a5279fba34d4959138480bd5b1e8c31.exe"C:\Users\Admin\AppData\Local\Temp\fad5bac606710818cfba4fa46914899f8a5279fba34d4959138480bd5b1e8c31.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4888999.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4888999.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9046265.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9046265.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p8049353.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p8049353.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4240
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r3348912.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r3348912.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe"C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legosa.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe" /F6⤵
- Creates scheduled task(s)
PID:352
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legosa.exe" /P "Admin:N"&&CACLS "legosa.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:3756
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "legosa.exe" /P "Admin:N"7⤵PID:4524
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "legosa.exe" /P "Admin:R" /E7⤵PID:4120
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:4528
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\ebb444342c" /P "Admin:N"7⤵PID:5084
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\ebb444342c" /P "Admin:R" /E7⤵PID:5092
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main6⤵
- Loads dropped DLL
PID:676
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s2711808.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s2711808.exe3⤵
- Executes dropped EXE
PID:4852
-
-
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exeC:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe1⤵
- Executes dropped EXE
PID:1456
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exeC:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe1⤵
- Executes dropped EXE
PID:4128
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
433KB
MD5645dc1dc5557354cf6a82591325197a2
SHA1e492414d3dc99c4c98b0461144bf891ca8d44455
SHA256ce3f2ced3ccd695e62f004312660ac1c3291b6ff5324a3562a0b88c897bad1e7
SHA5127854f0a205f9347ec5c43371f65b1bdd2d7b27f73c53a22ecc5fd6f98644476003de1afd7ad1cd9e3b4dd66f3470e62de7636dc8994622ca660e25cb0d571e76
-
Filesize
433KB
MD5645dc1dc5557354cf6a82591325197a2
SHA1e492414d3dc99c4c98b0461144bf891ca8d44455
SHA256ce3f2ced3ccd695e62f004312660ac1c3291b6ff5324a3562a0b88c897bad1e7
SHA5127854f0a205f9347ec5c43371f65b1bdd2d7b27f73c53a22ecc5fd6f98644476003de1afd7ad1cd9e3b4dd66f3470e62de7636dc8994622ca660e25cb0d571e76
-
Filesize
175KB
MD507367a3b8168de8346b7087c56bb59ff
SHA111c018642cbccc1f20dc3621e711ca58cdb590a6
SHA256c4bb9f26a73ab066485e455e53ee0c45bfeace83ab461a2cc4bed12aeaaeec98
SHA512702c134265850c163819b36f297eb026fd06a6a7d813114558617bad5d0b458dd1cd9ff63a64cffa45490dcc721a263f18e51419d975c3dbe5f4267e21d87d58
-
Filesize
175KB
MD507367a3b8168de8346b7087c56bb59ff
SHA111c018642cbccc1f20dc3621e711ca58cdb590a6
SHA256c4bb9f26a73ab066485e455e53ee0c45bfeace83ab461a2cc4bed12aeaaeec98
SHA512702c134265850c163819b36f297eb026fd06a6a7d813114558617bad5d0b458dd1cd9ff63a64cffa45490dcc721a263f18e51419d975c3dbe5f4267e21d87d58
-
Filesize
277KB
MD59d80a505bfe7ada9c310111dbaf8efc3
SHA1e04e50d0d5269b8943575f418f391c2358f677d1
SHA25695b23561d40bb5293c468990bf63b9c17146344d1deb3ddbb09f59403d6ba735
SHA512302f68455c3f31535a5caf1131b34b40f747f0c568b2636efc98418610b1f4040b7c28eed9ec1d1076c2f0fa8c57aacf8f44324a821db43a4ce187ab8dfd9664
-
Filesize
277KB
MD59d80a505bfe7ada9c310111dbaf8efc3
SHA1e04e50d0d5269b8943575f418f391c2358f677d1
SHA25695b23561d40bb5293c468990bf63b9c17146344d1deb3ddbb09f59403d6ba735
SHA512302f68455c3f31535a5caf1131b34b40f747f0c568b2636efc98418610b1f4040b7c28eed9ec1d1076c2f0fa8c57aacf8f44324a821db43a4ce187ab8dfd9664
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651